1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

76168 Commits

Author SHA1 Message Date
Yu Watanabe
c480e4cd66 network/l2tp: downgrade log level of several messages
Also, use log_section_warning_errno() where applicable.
2024-09-10 19:30:17 +09:00
Yu Watanabe
909acd37b8 network/veth: also manage peer name by Manager
Then, the Link object for the peer interface can have a reference to the
corresponding NetDev object.
2024-09-10 19:30:17 +09:00
Yu Watanabe
98fbb3b5b0 network/veth: refuse when peer and the main interface names are equivalent 2024-09-10 19:30:17 +09:00
Yu Watanabe
c60cd572bd network/netdev: add attach(), detach(), set_ifindex(), and get_ifindex() to netdev vtable
Currently no vtable sets these functions, but will be used later.
2024-09-10 19:30:17 +09:00
Yu Watanabe
36ca0164ab network/netdev: allow to register the same NetDev object with multiple names
Preparation for later commits.
2024-09-10 19:30:17 +09:00
Yu Watanabe
5dc20e1acd network/netdev: split out netdev_set_ifindex_internal() and _impl()
No functional change, just refactoring and preparation for later
commits.
2024-09-10 19:30:13 +09:00
Yu Watanabe
bfacb8fe1d network/netdev: split out netdev_attach() and netdev_attach_name() from netdev_load_one()
No functional change, just refactoring and preparation for later
commits.
2024-09-10 19:29:05 +09:00
Yu Watanabe
0dc71b9584 network/netdev: use hashmap_remove_value() on detaching NetDev from manager
Then, it is not necessary to free NetDev.ifname when a conflicting
.netdev file is already loaded.

This also split out netdev_detach_name() and netdev_detach_impl().

No functional change, just refactoring.
2024-09-10 19:29:05 +09:00
Yu Watanabe
bc0d3f3842 network/netdev: downgrade log level in netdev_set_ifindex()
This also makes netdev_enter_failed() called on caller side.

No functional change, just refactoring.
2024-09-10 19:29:05 +09:00
Yu Watanabe
5d7de25052 network/netdev: check family of received NEWLINK message
For safety. No functional change, just refactoring and preparation for
later commits.
2024-09-10 19:28:56 +09:00
Yu Watanabe
72fd133dca network/route: use NetDev object assigned to Link 2024-09-10 16:38:07 +09:00
Yu Watanabe
1788c34628 network/netdev: also check ifindex, iftype, and kind when assigning NetDev to Link
Even when a NetDev object with the same name found, its iftype or kind
may be different. For safety, let's also check them.
2024-09-10 16:38:06 +09:00
Lennart Poettering
f2129f1d8c
Merge pull request #34294 from poettering/uki-with-many-core
multi-profile UKIs (systemd-stub hookup)
2024-09-10 08:59:53 +02:00
Yu Watanabe
6d449bc71f
Merge pull request #34318 from YHNdnzj/networkctl-edit-if-netdev
networkctl: support editing netdev files by link and cat ":all"
2024-09-10 14:32:28 +09:00
Yu Watanabe
214c2508f3
Merge pull request #34336 from yuwata/nspawn-fuse-follow-ups
nspawn: follow-ups for FUSE support
2024-09-10 14:32:09 +09:00
Lennart Poettering
a632d8dd9f stub: add ability to place multiple alternative PE sections of a specific type in the same UKI ("Multi-Profile UKIs")
This adds a ability to add alternative sections of a specific type in
the same UKI. The primary usecase is for supporting multiple different
kernel cmdlines that are baked into a UKI.

The mechanism is relatively simple (I think), in order to make it robust.

1. A new PE section ".profile" is introduced, that is a lot like
   ".osrel", but contains information about a specific "profile" to
   boot. The ".profile" section can appear multiple times in the same
   PE, and acts as delimiter indicating where a new profile starts.
   Everything before the first ".profile" is called the "base profile",
   and is shared among all other profiles, which can then override or
   add addition PE sections on top.

2. An UKI's command line can be prefixed with an argument such as "@0" or
   "@1" or "@2" which indicates the "profile" to boot. If no argument is
   specified the default is profile 0. Also, a UKI that lacks any
   .profile section is treated like one with only a profile 0, but with
   no data in that profile section.

3. The stub will first search for its usual set of PE sections
   (hereafter called "base sections"), and stop at the first .profile PE
   section if any. It will then find the .profile matching the selected
   profile by its index, and any sections found as part of that profile
   on top of the base sections.

And that's already it.

Example: let's say a distro wants to provide a single UKI that can be
invoked in one of three ways:

1. The regular profile that just boots the system
2. A profile that boots into storagetm
3. A profile that initiates factory reset and reboots.

For this it would define a classic UKI with sections .linux, .initrd,
.cmdline, and whatever else it needs. The .cmdline section would contain
the kernel command line for the regular profile.

It would then insert one ".profile" section, with a contents like the
following:

    ID=regular

This is the profile for profile 0. It would immediately afterwards add
another ".profile" section:

    ID=storagetm
    TITLE=Boot into Storage Target Mode

This would then followed with a .cmdline section that is just like the
basic one, but with "rd.systemd.unit=storage-target-mode.target"
suffixed. Then, another .profile section would be added:

    ID=factory-reset
    TITLE=Factory Reset

Which is then followed by one last PE section: a .cmdline one with
"systemd.unit=factory-reset.target" suffixed to te regular command line.

i.e. expressed in tabular form the above would be:

    The base profile:
          .linux
          .initrd
          .cmdline
          .osrel
    The regular boot profile:
          .profile
    The storagetm profile:
          .profile
          .cmdline
    The factory reset profile:
          .profile
          .cmdline

You might wonder why the first .cmdline in the list above is placed in
the base profile rather than in the regular boot profile, given that it
is overriden in all other profiles anyway. And you are right. The only
reason I'd place it in the base profile is that it makes the UKI more
nicely extensible if later profiles are added that want to replace
something else instead of the .cmdline, for example .ucode or so. But it
really doesn't matter much.

While the primary usecase is of course multiple alternative command
lines, the concept is more powerful than that: for various usecases it
might be valuable to offer multiple choices of devicetree, ucode or
initrds.

The .profile contents is also passed to the invoked kernel as a file in
/.extra/profile (via a synthetic initrd). Thus, this functionality can
even be useful without overriding any section at all, simply by means of
reading that file from userspace.

Design choices:

1. On purposes I used a special command line marker (i.e. the "@" thing,
   which maybe we should call the "profile selector"), that doesn't look
   like a regular kernel command line option.  This is because this is
   really not a regular kernel command line option – we process it in
   the stub, then remove it as prefix, and measure the unprefixed
   command line only after that. The kernel will not see the profile
   selector either. I think these special semantics are best
   communicated by making it look substantially different from regular
   options.

2. This moves around measurements a bit. Previously we measured our UKI
   sections right after finding them. Now we first parse the profile
   number from the command line, then search for the profile's sections,
   and only then measure the sections we actually end up using for this
   profile. I think that this logic makes most sense: measure what we
   are using, not what we are overriding. Or in other words, if you boot
   profile @3, then we'll measure .cmdline (assuming it exists) of
   profile 3, and *not* measure .cmdline of the base profile. Also note
   that if the user passes in a custom kernel command line via command
   line arguments we'll strip off the profile selector (i.e. the initial
   "@X" thing) before we pass it on.

3. The .profile stuff is supposed to be generic and extensible. For
   example we could use it in future to mark "dangerous" options such as
   factory reset, so that boot menus can ask for confirmation before
   booting into it. Or we could introduce match expressions against
   SMBIOS or other system identifiers, to filter out profiles on
   specific hw.

Note btw, that PE allows defining multiple sections that point to the
same offsets in the file. This allows sharing payload under different
names. For example, if profile @4 and @7 shall carry the same .ucode
section, they can define .ucode in each profile and then make it point to
the same offset.

Also note that that one can even "mask" a base section in a profile, by
inserting an empty section. For example, if the base .dtb section should
not be used for profile @4, then add a section .dtb right after the
fourth .profile with a zero size to the UKI, and you will get your wish
fulfilled.

This code only contains changes to sd-stub. A follow-up commit will
teach sd-boot to also find this profile PE sections to synthesize
additional menu entries from a single UKI.

A later commit will add support for gnerating this via ukify.

Fixes: #24539
2024-09-10 06:49:08 +02:00
Lennart Poettering
f4e081051d efi: teach PE parsing support for ".profile" sections
This adds helpers for:

1. Returning the PE section table of open PE files or memory

2. Scanning PE section tables for the sections that belong to a specific
   profile
2024-09-10 06:49:08 +02:00
Lennart Poettering
52dd7c8131 efi: add free_and_xstrdup16() helper modelled after free_and_strdup() in userspace 2024-09-10 06:48:38 +02:00
Lennart Poettering
9f6f3bd2fb
Merge pull request #34297 from poettering/shell-prompt-extra
shell: define three system credentials we can propagate into shell prompts and welcome msgs
2024-09-10 06:42:31 +02:00
Lennart Poettering
89cdd4866a
Merge pull request #34328 from poettering/analyze-help-text
analyze: --help text improvements
2024-09-10 06:42:03 +02:00
Lennart Poettering
b4199a97e6
Merge pull request #34330 from poettering/shutdown-async-sync
shutdown: make all fsync()s asynchronous and apply timeout
2024-09-10 06:41:46 +02:00
Mike Yuan
0d3787deac
networkctl: support editing netdev files by link and cat ":all"
Also, don't abuse RET_GATHER in verb_cat(), where the failures
are most likely unrelated to each other.

Closes #34281
2024-09-09 23:20:42 +02:00
Mike Yuan
c9837c17d5
networkctl-status-link: show netdev files associated with link 2024-09-09 23:20:42 +02:00
Mike Yuan
4591c89a15
sd-network: introduce sd_network_link_get_netdev_file{,_dropins} 2024-09-09 23:20:42 +02:00
Mike Yuan
2cf9b1a0ee
network: store netdev drop-in paths and dump into state file 2024-09-09 23:20:41 +02:00
Mike Yuan
4c8dc66438
networkd-state-file: use ASSERT_PTR where appropriate 2024-09-09 21:45:42 +02:00
Yu Watanabe
da7fb6dad7 nspawn: use ERRNO_IS_NEG_NOT_SUPPORTED() at one more place
Follow-up for dc3223919f.
Addresses https://github.com/systemd/systemd/pull/34067#discussion_r1748061156.

Error codes other than ENOSYS may not come here, but if it comes, still
there is nothing we can do here, so let's not log the failure loudly.
2024-09-10 04:38:33 +09:00
Yu Watanabe
b86b90cec5 nspawn: sync DeviceAllow= setting with systemd-nspawn@.service
Follow-up for dc3223919f.
Addresses https://github.com/systemd/systemd/pull/34067#discussion_r1748592958.

Otherwise, containers started with and without --keep-unit option run in
different device policies.
2024-09-10 04:38:11 +09:00
Lennart Poettering
b4b66b2662 shutdown: replace unbounded fsync() with bounded sync_with_progress()
Let's put a time-out on this syncing.

Inspired-by: #34289 #34283
2024-09-09 19:12:31 +02:00
Lennart Poettering
13b5225d62 shutdown: teach sync_with_progress() to optionally sync a specific fd only
This is preparation for reusing the logic for syncing DM and other
devices with a timeout applied.
2024-09-09 19:12:31 +02:00
Lennart Poettering
a8ea7c1940 meson: tweak meson conditionalization for ssh{d,}_config drop-ins
Let's make sure "no" is an acceptable setting for these paths.
2024-09-09 19:03:48 +02:00
Lennart Poettering
229d4a9806 shell: define three system credentials we can propagate into shell prompts and welcome messages 2024-09-09 19:03:48 +02:00
Lennart Poettering
8b29949a41 machinectl: suppress redirection notice if --quiet is specified 2024-09-09 18:58:57 +02:00
Daan De Meyer
fa693fdc7e core: Add support for PrivateUsers=identity
This configures an indentity mapping similar to
systemd-nspawn --private-users=identity.
2024-09-09 18:31:01 +02:00
Yanqing Jing
d8b4be38dd update keyboard hwdb to add acer Predator PHN16-72 2024-09-09 17:19:28 +02:00
Lennart Poettering
7a3223f509
Merge pull request #34258 from yuwata/nspawn-volatile-u
nspawn: make --volatile work with -U
2024-09-09 17:11:11 +02:00
Lennart Poettering
645a3fa9e8 analyze: add some roughly useful subsections to --help text
It's a long long list of verbs we support now, let's make it easier to
digest, like we did in systemctl --help and elsewhere.
2024-09-09 17:01:22 +02:00
Lennart Poettering
fd4b848436 analyze: add section underlining to --help text
Do this like we usually do these days.
2024-09-09 17:01:19 +02:00
Daan De Meyer
c1852f9d5f sysupdate: Add --transfer-source=
In mkosi, I want to add a sysupdate verb to wrap systemd-sysupdate.
The definitions will be picked up from mkosi.sysupdate/ and passed
to systemd-sysupdate. I want users to be able to write transfer
definitions that are independent of the output directory used by
mkosi. To make this possible, it should be possible to specify the
directory that transfer sources should be looked up in on the sysupdate
command line. Let's allow this via a new --transfer-source= option.

Additionally, transfer sources that want to take advantage of this
feature should specify PathRelativeTo=directory to indicate the configured
Path= is interpreted relative to the tranfer source directory specified
on the CLI.

This allows for the following transfer definition to be put in
mkosi.sysupdate:

"""
[Transfer]
ProtectVersion=%A

[Source]
Type=regular-file
Path=/
PathRelativeTo=directory
MatchPattern=ParticleOS_@v.usr-%a.@u.raw

[Target]
Type=partition
Path=auto
MatchPattern=ParticleOS_@v
MatchPartitionType=usr
PartitionFlags=0
ReadOnly=1
"""
2024-09-09 16:41:52 +02:00
Mike Yuan
4ec630bfba
Merge pull request #33833 from YHNdnzj/manager-reload-assert
core/manager: do not re-init Manager.lookup_paths when manager_reload(), minor assorted cleanups
2024-09-09 14:21:57 +02:00
Daan De Meyer
6e4d47b5ae repart: Initialize split_name_format in copy_from_one()
Let's allow splitting the partitions from an existing disk image
by initializing split_name_format when using --copy-from=.
2024-09-09 13:22:26 +02:00
Yu Watanabe
c1062559a9
Merge pull request #34307 from yuwata/linux-more-network-headers
linux: import more network headers
2024-09-09 19:33:14 +09:00
Yu Watanabe
ef32235db1
Merge pull request #34067 from LukeShu/lukeshu/nspawn-fuse
nspawn: enable FUSE in containers
2024-09-09 19:32:16 +09:00
Yu Watanabe
85fd8df03d missing_socket: drop unnecessary definitions
Now, we have copy of vm_sockets.h, hence these definitions are not
necessary anymore.
2024-09-09 14:52:18 +09:00
Yu Watanabe
47a71f9852 missing_network: drop unnecessary definition
Now we have ipv6.h, hence the definition is not necessary anymore.
2024-09-09 14:52:18 +09:00
Yu Watanabe
0ca88780d6 arphrd-list: use imported linux/if_arp.h 2024-09-09 14:52:18 +09:00
Yu Watanabe
a84649592c linux: import more network related headers from v6.11-rc6
Hopefully, no effective change.
2024-09-09 14:52:18 +09:00
Mike Yuan
978e7d166c terminal-util: correct fd validity check
Follow-up for 14f594b995
2024-09-08 20:45:33 +02:00
samuelvw01
54ada3d13a Fix typo in escape.c 2024-09-08 18:55:13 +09:00
Erik Sjölund
fdc1b714d4 TODO: fix typo 2024-09-08 18:54:20 +09:00